@unbrained/pm-cli 2026.10.12 → 2026.10.14

package/node_modules/@sentry/core/build/esm/fetch.js

@@ -9,6 +9,7 @@ import { SentryNonRecordingSpan } from './tracing/sentryNonRecordingSpan.js';
 import { SENTRY_BAGGAGE_KEY_PREFIX } from './utils/baggage.js';
 import { hasSpanStreamingEnabled } from './tracing/spans/hasSpanStreamingEnabled.js';
 import { startInactiveSpan, spanIsIgnored } from './tracing/trace.js';
+import { filterCollectedUrl, filterCollectedUrlQuery } from './utils/data-collection/filterCollectedUrl.js';
 import { getTraceData } from './utils/traceData.js';
 import { stripDataUrlContent, parseStringToURLObject, getSanitizedUrlStringFromUrlObject, isURLObjectRelative } from './utils/url.js';
 
@@ -35,7 +36,7 @@ function instrumentFetchRequest(handlerData, shouldCreateSpan, shouldAttachHeade
   const client = getClient();
   const hasParent = !!getActiveSpan();
   const shouldEmitSpan = hasParent || !!client && hasSpanStreamingEnabled(client);
-  const span = shouldCreateSpanResult && shouldEmitSpan ? startInactiveSpan(getSpanStartOptions(url, method, spanOrigin)) : new SentryNonRecordingSpan();
+  const span = shouldCreateSpanResult && shouldEmitSpan ? startInactiveSpan(getSpanStartOptions(url, method, spanOrigin, client)) : new SentryNonRecordingSpan();
   const spanForTraceHeaders = spanIsIgnored(span) && hasParent ? void 0 : span;
   if (shouldCreateSpanResult && !shouldEmitSpan) {
     client?.recordDroppedEvent("no_parent_span", "span");
@@ -175,24 +176,24 @@ function isHeadersInitTupleArray(headers) {
     (item) => Array.isArray(item) && item.length === 2 && typeof item[0] === "string"
   );
 }
-function getSpanStartOptions(url, method, spanOrigin) {
+function getSpanStartOptions(url, method, spanOrigin, client) {
   if (url.startsWith("data:")) {
     const sanitizedUrl2 = stripDataUrlContent(url);
     return {
       name: `${method} ${sanitizedUrl2}`,
-      attributes: getFetchSpanAttributes(url, void 0, method, spanOrigin)
+      attributes: getFetchSpanAttributes(url, void 0, method, spanOrigin, client)
     };
   }
   const parsedUrl = parseStringToURLObject(url);
   const sanitizedUrl = parsedUrl ? getSanitizedUrlStringFromUrlObject(parsedUrl) : url;
   return {
     name: `${method} ${sanitizedUrl}`,
-    attributes: getFetchSpanAttributes(url, parsedUrl, method, spanOrigin)
+    attributes: getFetchSpanAttributes(url, parsedUrl, method, spanOrigin, client)
   };
 }
-function getFetchSpanAttributes(url, parsedUrl, method, spanOrigin) {
+function getFetchSpanAttributes(url, parsedUrl, method, spanOrigin, client) {
   const attributes = {
-    url: stripDataUrlContent(url),
+    url: filterCollectedUrl(stripDataUrlContent(url), client),
     type: "fetch",
     "http.method": method,
     [SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN]: spanOrigin,
@@ -200,12 +201,12 @@ function getFetchSpanAttributes(url, parsedUrl, method, spanOrigin) {
   };
   if (parsedUrl) {
     if (!isURLObjectRelative(parsedUrl)) {
-      attributes[HTTP_URL] = stripDataUrlContent(parsedUrl.href);
-      attributes[URL_FULL] = stripDataUrlContent(parsedUrl.href);
+      attributes[HTTP_URL] = filterCollectedUrl(stripDataUrlContent(parsedUrl.href), client);
+      attributes[URL_FULL] = filterCollectedUrl(stripDataUrlContent(parsedUrl.href), client);
       attributes["server.address"] = parsedUrl.host;
     }
     if (parsedUrl.search) {
-      attributes["http.query"] = parsedUrl.search;
+      attributes["http.query"] = filterCollectedUrlQuery(parsedUrl.search, client);
     }
     if (parsedUrl.hash) {
       attributes["http.fragment"] = parsedUrl.hash;

package/node_modules/@sentry/core/build/esm/index.js

@@ -35,6 +35,7 @@ export { _INTERNAL_clearAiProviderSkips, _INTERNAL_shouldSkipAiProviderWrapping,
 export { filterKeyValueData as _INTERNAL_filterKeyValueData } from './utils/data-collection/filterKeyValueData.js';
 export { filterCookies as _INTERNAL_filterCookies } from './utils/data-collection/filterCookies.js';
 export { filterQueryParams as _INTERNAL_filterQueryParams } from './utils/data-collection/filterQueryParams.js';
+export { filterCollectedUrl, filterCollectedUrlQuery } from './utils/data-collection/filterCollectedUrl.js';
 export { envToBool } from './utils/envToBool.js';
 export { applyScopeDataToEvent, getCombinedScopeData, mergeScopeData } from './utils/scopeData.js';
 export { prepareEvent } from './utils/prepareEvent.js';

package/node_modules/@sentry/core/build/esm/integrations/http/add-outgoing-request-breadcrumb.js

@@ -1,5 +1,6 @@
 import { addBreadcrumb } from '../../breadcrumbs.js';
 import { getBreadcrumbLogLevelFromHttpStatusCode } from '../../utils/breadcrumb-log-level.js';
+import { filterCollectedUrlQuery } from '../../utils/data-collection/filterCollectedUrl.js';
 import { parseUrl, getSanitizedUrlString } from '../../utils/url.js';
 import { getRequestUrlFromClientRequest } from './get-request-url.js';
 
@@ -15,7 +16,7 @@ function addOutgoingRequestBreadcrumb(request, response) {
         status_code: statusCode,
         url: getSanitizedUrlString(parsedUrl),
         "http.method": request.method || "GET",
-        ...parsedUrl.search ? { "http.query": parsedUrl.search } : {},
+        ...parsedUrl.search ? { "http.query": filterCollectedUrlQuery(parsedUrl.search) } : {},
         ...parsedUrl.hash ? { "http.fragment": parsedUrl.hash } : {}
       },
       type: "http",

package/node_modules/@sentry/core/build/esm/integrations/http/get-outgoing-span-data.js

@@ -1,4 +1,5 @@
 import { SEMANTIC_ATTRIBUTE_SENTRY_OP } from '../../semanticAttributes.js';
+import { filterCollectedUrl } from '../../utils/data-collection/filterCollectedUrl.js';
 import { getHttpSpanDetailsFromUrlObject, parseStringToURLObject } from '../../utils/url.js';
 import { getRequestUrlFromClientRequest } from './get-request-url.js';
 
@@ -18,9 +19,9 @@ function getOutgoingRequestSpanData(request) {
       // https://getsentry.github.io/sentry-conventions/attributes/
       [SEMANTIC_ATTRIBUTE_SENTRY_OP]: "http.client",
       "otel.kind": "CLIENT",
-      "http.url": url,
+      "http.url": filterCollectedUrl(url),
       "http.method": request.method,
-      "http.target": request.path || "/",
+      "http.target": filterCollectedUrl(request.path || "/"),
       "net.peer.name": request.host,
       "http.host": request.getHeader("host"),
       ...userAgent ? { "user_agent.original": userAgent } : {},

package/node_modules/@sentry/core/build/esm/integrations/http/server-subscription.js

@@ -14,6 +14,7 @@ import { SEMANTIC_ATTRIBUTE_SENTRY_SOURCE, SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN, SEM
 import { getSpanStatusFromHttpCode, SPAN_STATUS_ERROR } from '../../tracing/spanstatus.js';
 import { HTTP_URL, URL_PATH, URL_FULL } from '@sentry/conventions/attributes';
 import { SPAN_KIND } from '../../spanKind.js';
+import { filterCollectedUrl } from '../../utils/data-collection/filterCollectedUrl.js';
 
 const INTEGRATION_NAME = "Http.Server";
 const SPANS_INTEGRATION_NAME = "Http.SentryServerSpans";
@@ -192,12 +193,15 @@ function buildServerSpanWrap(options) {
             "net.peer.port": remotePort,
             "sentry.http.prefetch": isKnownPrefetchRequest(request) || void 0,
             // Old Semantic Conventions attributes for compatibility
-            [URL_FULL]: urlObj && !isURLObjectRelative(urlObj) ? urlObj.href : void 0,
+            [URL_FULL]: urlObj && !isURLObjectRelative(urlObj) ? filterCollectedUrl(urlObj.href, client) : void 0,
             [URL_PATH]: urlObj?.pathname ?? httpTargetWithoutQueryFragment,
             // oxlint-disable-next-line typescript-eslint(no-deprecated)
-            [HTTP_URL]: fullUrl,
+            [HTTP_URL]: filterCollectedUrl(fullUrl, client),
             "http.method": method,
-            "http.target": urlObj ? `${urlObj.pathname}${urlObj.search}` : httpTargetWithoutQueryFragment,
+            "http.target": filterCollectedUrl(
+              urlObj ? `${urlObj.pathname}${urlObj.search}` : httpTargetWithoutQueryFragment,
+              client
+            ),
             "http.host": host,
             "net.host.name": hostname,
             "http.client_ip": typeof ips === "string" ? ips.split(",")[0] : void 0,

package/node_modules/@sentry/core/build/esm/integrations/requestdata.js

@@ -2,6 +2,8 @@ import { getIsolationScope } from '../currentScopes.js';
 import { defineIntegration } from '../integration.js';
 import { SEMANTIC_ATTRIBUTE_USER_IP_ADDRESS } from '../semanticAttributes.js';
 import { parseCookie } from '../utils/cookie.js';
+import { filterQueryParams } from '../utils/data-collection/filterQueryParams.js';
+import { filterUrlQuery } from '../utils/data-collection/filterUrlQuery.js';
 import { httpHeadersToSpanAttributes } from '../utils/request.js';
 import { getClientIPAddress, ipHeaderNames } from '../vendor/getIpAddress.js';
 import { safeSetSpanJSONAttributes } from '../tracing/spans/captureSpan.js';
@@ -16,7 +18,8 @@ const _requestDataIntegration = ((options = {}) => {
       ...options.include?.cookies === true && dc.cookies === false && { cookies: true },
       ...options.include?.headers === true && dc.httpHeaders.request === false && {
         httpHeaders: { ...dc.httpHeaders, request: true }
-      }
+      },
+      ...options.include?.query_string === true && dc.urlQueryParams === false && { urlQueryParams: true }
     };
     return {
       dataCollection,
@@ -38,9 +41,9 @@ const _requestDataIntegration = ((options = {}) => {
     processEvent(event, _hint, client) {
       const { sdkProcessingMetadata = {} } = event;
       const { normalizedRequest, ipAddress } = sdkProcessingMetadata;
-      const { include } = resolveIncludeAndDataCollection(client);
+      const { include, dataCollection } = resolveIncludeAndDataCollection(client);
       if (normalizedRequest) {
-        addNormalizedRequestDataToEvent(event, normalizedRequest, { ipAddress }, include);
+        addNormalizedRequestDataToEvent(event, normalizedRequest, { ipAddress }, include, dataCollection);
       }
       return event;
     },
@@ -56,10 +59,17 @@ const _requestDataIntegration = ((options = {}) => {
   };
 });
 const requestDataIntegration = defineIntegration(_requestDataIntegration);
-function addNormalizedRequestDataToEvent(event, req, additionalData, include) {
+function addNormalizedRequestDataToEvent(event, req, additionalData, include, dataCollection) {
+  const requestData = extractNormalizedRequestData(req, include);
+  if (requestData.query_string) {
+    requestData.query_string = normalizeAndFilterQueryString(requestData.query_string, dataCollection.urlQueryParams);
+  }
+  if (requestData.url) {
+    requestData.url = filterUrlQuery(requestData.url, dataCollection.urlQueryParams);
+  }
   event.request = {
     ...event.request,
-    ...extractNormalizedRequestData(req, include)
+    ...requestData
   };
   if (include.ip) {
     const ip = req.headers && getClientIPAddress(req.headers) || additionalData.ipAddress;
@@ -75,13 +85,13 @@ function addNormalizedRequestDataToSpan(span, normalizedRequest, ipAddress, incl
   const requestData = extractNormalizedRequestData(normalizedRequest, include);
   const attributes = {};
   if (requestData.url) {
-    attributes[URL_FULL] = requestData.url;
+    attributes[URL_FULL] = filterUrlQuery(requestData.url, dataCollection.urlQueryParams);
   }
   if (requestData.method) {
     attributes["http.request.method"] = requestData.method;
   }
   if (requestData.query_string) {
-    attributes[URL_QUERY] = normalizeQueryString(requestData.query_string);
+    attributes[URL_QUERY] = normalizeAndFilterQueryString(requestData.query_string, dataCollection.urlQueryParams);
   }
   safeSetSpanJSONAttributes(span, attributes);
   if (requestData.cookies && Object.keys(requestData.cookies).length > 0) {
@@ -139,13 +149,17 @@ function extractNormalizedRequestData(normalizedRequest, include) {
   }
   return requestData;
 }
+function normalizeAndFilterQueryString(queryString, behavior) {
+  const normalized = normalizeQueryString(queryString);
+  return normalized ? filterQueryParams(normalized, behavior) : void 0;
+}
 function normalizeQueryString(queryString) {
   if (typeof queryString === "string") {
     return queryString || void 0;
   }
   const pairs = Array.isArray(queryString) ? queryString : Object.entries(queryString);
-  const result = pairs.map(([key, value]) => `${key}=${value}`).join("&");
-  return result || void 0;
+  const normalized = new URLSearchParams(pairs).toString();
+  return normalized || void 0;
 }
 
 export { requestDataIntegration };

package/node_modules/@sentry/core/build/esm/package.json

@@ -1 +1 @@
-{"type":"module","version":"10.75.1","sideEffects":false}
+{"type":"module","version":"10.76.0","sideEffects":false}

package/node_modules/@sentry/core/build/esm/server.js

@@ -35,6 +35,7 @@ export { _INTERNAL_clearAiProviderSkips, _INTERNAL_shouldSkipAiProviderWrapping,
 export { filterKeyValueData as _INTERNAL_filterKeyValueData } from './utils/data-collection/filterKeyValueData.js';
 export { filterCookies as _INTERNAL_filterCookies } from './utils/data-collection/filterCookies.js';
 export { filterQueryParams as _INTERNAL_filterQueryParams } from './utils/data-collection/filterQueryParams.js';
+export { filterCollectedUrl, filterCollectedUrlQuery } from './utils/data-collection/filterCollectedUrl.js';
 export { envToBool } from './utils/envToBool.js';
 export { applyScopeDataToEvent, getCombinedScopeData, mergeScopeData } from './utils/scopeData.js';
 export { prepareEvent } from './utils/prepareEvent.js';

package/node_modules/@sentry/core/build/esm/utils/data-collection/filterCollectedUrl.js

@@ -0,0 +1,21 @@
+import { getClient } from '../../currentScopes.js';
+import { filterQueryParams } from './filterQueryParams.js';
+import { filterUrlQuery } from './filterUrlQuery.js';
+
+function urlQueryParamsBehavior(client) {
+  return (client ?? getClient())?.getDataCollectionOptions().urlQueryParams ?? true;
+}
+function filterCollectedUrl(url, client) {
+  return url === void 0 ? void 0 : filterUrlQuery(url, urlQueryParamsBehavior(client));
+}
+function filterCollectedUrlQuery(query, client) {
+  if (!query) {
+    return query;
+  }
+  const hasPrefix = query.startsWith("?");
+  const filtered = filterQueryParams(hasPrefix ? query.slice(1) : query, urlQueryParamsBehavior(client));
+  return filtered && hasPrefix ? `?${filtered}` : filtered;
+}
+
+export { filterCollectedUrl, filterCollectedUrlQuery };
+//# sourceMappingURL=filterCollectedUrl.js.map

package/node_modules/@sentry/core/build/esm/utils/data-collection/filterKeyValueData.js

@@ -1,41 +1,34 @@
-import { SENSITIVE_KEY_SNIPPETS, FILTERED_VALUE } from './filtering-snippets.js';
+import { FILTERED_VALUE, SENSITIVE_KEY_SNIPPETS } from './filtering-snippets.js';
 
 function isSensitiveKey(lower, denySnippets) {
   return denySnippets.some((snippet) => lower.includes(snippet));
 }
-function filterKeyValueData(data, behavior, additionalDenyTerms) {
+function shouldFilterDataKey(key, behavior, additionalDenyTerms) {
   if (behavior === false) {
-    return {};
+    return true;
   }
+  const lowerKey = key.toLowerCase();
   const denySnippets = additionalDenyTerms != null ? [...SENSITIVE_KEY_SNIPPETS, ...additionalDenyTerms] : SENSITIVE_KEY_SNIPPETS;
-  const result = {};
+  if (isSensitiveKey(lowerKey, denySnippets)) {
+    return true;
+  }
   if (behavior === true) {
-    for (const key of Object.keys(data)) {
-      result[key] = isSensitiveKey(key.toLowerCase(), denySnippets) ? FILTERED_VALUE : data[key];
-    }
-    return result;
+    return false;
   }
-  if ("deny" in behavior) {
-    const lowerTerms2 = behavior.deny.map((t) => t.toLowerCase());
-    for (const key of Object.keys(data)) {
-      const lower = key.toLowerCase();
-      const isDenied = isSensitiveKey(lower, denySnippets) || lowerTerms2.some((term) => lower.includes(term));
-      result[key] = isDenied ? FILTERED_VALUE : data[key];
-    }
-    return result;
+  const terms = "deny" in behavior ? behavior.deny : behavior.allow;
+  const matchesConfiguredTerm = terms.some((term) => lowerKey.includes(term.toLowerCase()));
+  return "deny" in behavior ? matchesConfiguredTerm : !matchesConfiguredTerm;
+}
+function filterKeyValueData(data, behavior, additionalDenyTerms) {
+  if (behavior === false) {
+    return {};
   }
-  const lowerTerms = behavior.allow.map((t) => t.toLowerCase());
+  const result = {};
   for (const key of Object.keys(data)) {
-    const lower = key.toLowerCase();
-    if (isSensitiveKey(lower, denySnippets)) {
-      result[key] = FILTERED_VALUE;
-    } else {
-      const isAllowed = lowerTerms.some((term) => lower.includes(term));
-      result[key] = isAllowed ? data[key] : FILTERED_VALUE;
-    }
+    result[key] = shouldFilterDataKey(key, behavior, additionalDenyTerms) ? FILTERED_VALUE : data[key];
   }
   return result;
 }
 
-export { filterKeyValueData };
+export { filterKeyValueData, shouldFilterDataKey };
 //# sourceMappingURL=filterKeyValueData.js.map

package/node_modules/@sentry/core/build/esm/utils/data-collection/filterQueryParams.js

@@ -1,23 +1,16 @@
 import { FILTERED_VALUE } from './filtering-snippets.js';
-import { filterKeyValueData } from './filterKeyValueData.js';
+import { shouldFilterDataKey } from './filterKeyValueData.js';
 
 function filterQueryParams(queryString, behavior) {
-  if (behavior === false) {
-    return {};
-  }
-  try {
-    const params = new URLSearchParams(queryString);
-    const parsed = {};
-    params.forEach((value, key) => {
-      parsed[key] = value;
-    });
-    if (Object.keys(parsed).length === 0) {
-      return {};
-    }
-    return filterKeyValueData(parsed, behavior);
-  } catch {
-    return FILTERED_VALUE;
+  if (!queryString || behavior === false) {
+    return void 0;
   }
+  return queryString.split("&").map((pair) => {
+    const separatorIndex = pair.indexOf("=");
+    const encodedKey = separatorIndex === -1 ? pair : pair.slice(0, separatorIndex);
+    const key = new URLSearchParams(`${encodedKey}=`).keys().next().value;
+    return key !== void 0 && shouldFilterDataKey(key, behavior) ? `${encodedKey}=${FILTERED_VALUE}` : pair;
+  }).join("&");
 }
 
 export { filterQueryParams };

package/node_modules/@sentry/core/build/esm/utils/data-collection/filterUrlQuery.js

@@ -0,0 +1,18 @@
+import { filterQueryParams } from './filterQueryParams.js';
+
+function filterUrlQuery(url, behavior) {
+  const fragmentStart = url.indexOf("#");
+  const queryEnd = fragmentStart === -1 ? url.length : fragmentStart;
+  const queryStart = url.indexOf("?");
+  if (queryStart === -1 || queryStart > queryEnd) {
+    return url;
+  }
+  const prefix = url.slice(0, queryStart);
+  const query = url.slice(queryStart + 1, queryEnd);
+  const suffix = url.slice(queryEnd);
+  const filtered = filterQueryParams(query, behavior);
+  return filtered ? `${prefix}?${filtered}${suffix}` : `${prefix}${suffix}`;
+}
+
+export { filterUrlQuery };
+//# sourceMappingURL=filterUrlQuery.js.map

package/node_modules/@sentry/core/build/esm/utils/url.js

@@ -1,5 +1,6 @@
 import { URL_FULL } from '@sentry/conventions/attributes';
 import { SEMANTIC_ATTRIBUTE_SENTRY_SOURCE, SEMANTIC_ATTRIBUTE_HTTP_REQUEST_METHOD, SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN } from '../semanticAttributes.js';
+import { filterCollectedUrlQuery, filterCollectedUrl } from './data-collection/filterCollectedUrl.js';
 
 const DEFAULT_BASE_URL = "thismessage:/";
 function isURLObjectRelative(url) {
@@ -49,7 +50,7 @@ function getHttpSpanNameFromUrlObject(urlObject, kind, request, routeName) {
   const route = routeName ? routeName : urlObject ? kind === "client" ? getSanitizedUrlStringFromUrlObject(urlObject) : urlObject.pathname : "/";
   return `${method} ${route}`;
 }
-function getHttpSpanDetailsFromUrlObject(urlObject, kind, spanOrigin, request, routeName) {
+function getHttpSpanDetailsFromUrlObject(urlObject, kind, spanOrigin, request, routeName, client) {
   const attributes = {
     [SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN]: spanOrigin,
     [SEMANTIC_ATTRIBUTE_SENTRY_SOURCE]: "url"
@@ -63,7 +64,7 @@ function getHttpSpanDetailsFromUrlObject(urlObject, kind, spanOrigin, request, r
   }
   if (urlObject) {
     if (urlObject.search) {
-      attributes["url.query"] = urlObject.search;
+      attributes["url.query"] = filterCollectedUrlQuery(urlObject.search, client);
     }
     if (urlObject.hash) {
       attributes["url.fragment"] = urlObject.hash;
@@ -75,7 +76,7 @@ function getHttpSpanDetailsFromUrlObject(urlObject, kind, spanOrigin, request, r
       }
     }
     if (!isURLObjectRelative(urlObject)) {
-      attributes[URL_FULL] = urlObject.href;
+      attributes[URL_FULL] = filterCollectedUrl(urlObject.href, client);
       if (urlObject.port) {
         attributes["url.port"] = urlObject.port;
       }

package/node_modules/@sentry/core/build/esm/utils/version.js

@@ -1,4 +1,4 @@
-const SDK_VERSION = "10.75.1" ;
+const SDK_VERSION = "10.76.0" ;
 
 export { SDK_VERSION };
 //# sourceMappingURL=version.js.map

package/node_modules/@sentry/core/build/types/shared-exports.d.ts

@@ -31,6 +31,7 @@ export { _INTERNAL_skipAiProviderWrapping, _INTERNAL_shouldSkipAiProviderWrappin
 export { filterKeyValueData as _INTERNAL_filterKeyValueData } from './utils/data-collection/filterKeyValueData';
 export { filterCookies as _INTERNAL_filterCookies } from './utils/data-collection/filterCookies';
 export { filterQueryParams as _INTERNAL_filterQueryParams } from './utils/data-collection/filterQueryParams';
+export { filterCollectedUrl, filterCollectedUrlQuery } from './utils/data-collection/filterCollectedUrl';
 export { envToBool } from './utils/envToBool';
 export { applyScopeDataToEvent, mergeScopeData, getCombinedScopeData } from './utils/scopeData';
 export { prepareEvent } from './utils/prepareEvent';

package/node_modules/@sentry/core/build/types/utils/data-collection/filterCollectedUrl.d.ts

@@ -0,0 +1,21 @@
+import type { Client } from '../../client';
+/**
+ * Applies `dataCollection.urlQueryParams` to a URL the SDK collected itself, for use as `url.full`.
+ *
+ * Call this at every site where instrumentation records a URL. Routing the SDK's own URLs through a
+ * helper is what makes the filtering provenance-correct: a URL a user attaches themselves never passes
+ * through here, and `dataCollection` is only meant to gate automatically collected data.
+ *
+ * Pass the `client` the URL belongs to whenever one is at hand — falling back to `getClient()` resolves
+ * against the current scope, which is the wrong client in a multi-client setup.
+ */
+export declare function filterCollectedUrl(url: string, client?: Client): string;
+export declare function filterCollectedUrl(url: string | undefined, client?: Client): string | undefined;
+/**
+ * Applies `dataCollection.urlQueryParams` to a query string the SDK collected itself, for use as
+ * `url.query`. Returns `undefined` when the query must not be collected at all.
+ *
+ * See {@link filterCollectedUrl} for why this is a helper and why passing `client` is preferred.
+ */
+export declare function filterCollectedUrlQuery(query: string | undefined, client?: Client): string | undefined;
+//# sourceMappingURL=filterCollectedUrl.d.ts.map

package/node_modules/@sentry/core/build/types/utils/data-collection/filterKeyValueData.d.ts

@@ -1,4 +1,5 @@
 import type { CollectBehavior } from '../../types/datacollection';
+export declare function shouldFilterDataKey(key: string, behavior: CollectBehavior, additionalDenyTerms?: string[]): boolean;
 /**
  * Filters a key-value record according to a `CollectBehavior`.
  *

package/node_modules/@sentry/core/build/types/utils/data-collection/filterQueryParams.d.ts

@@ -2,8 +2,7 @@ import type { CollectBehavior } from '../../types/datacollection';
 /**
  * Filters a query parameter string according to a `CollectBehavior`.
  *
- * When individual params can be parsed, each key-value pair is filtered
- * independently. When parsing fails, the entire string is replaced with `[Filtered]`.
+ * Parameter names are decoded for filtering, while the original encoding, order, and duplicate keys are preserved.
  */
-export declare function filterQueryParams(queryString: string, behavior: CollectBehavior): Record<string, string> | string;
+export declare function filterQueryParams(queryString: string, behavior: CollectBehavior): string | undefined;
 //# sourceMappingURL=filterQueryParams.d.ts.map

package/node_modules/@sentry/core/build/types/utils/data-collection/filterUrlQuery.d.ts

@@ -0,0 +1,13 @@
+import type { CollectBehavior } from '../../types/datacollection';
+/**
+ * Applies a `CollectBehavior` to the query string of a full URL, leaving every other URL component
+ * (scheme, host, path, fragment) untouched.
+ *
+ * The query is located by string offsets rather than by parsing, so the URL is returned byte-for-byte
+ * apart from the query itself. This keeps relative URLs, non-HTTP schemes and unusual encodings intact,
+ * none of which survive a `URL` round-trip.
+ *
+ * Returns the URL with its query filtered, or with the query removed entirely when collection is off.
+ */
+export declare function filterUrlQuery(url: string, behavior: CollectBehavior): string;
+//# sourceMappingURL=filterUrlQuery.d.ts.map

package/node_modules/@sentry/core/build/types/utils/url.d.ts

@@ -1,3 +1,4 @@
+import type { Client } from '../client';
 import type { SpanAttributes } from '../types/span';
 type PartialURL = {
     host?: string;
@@ -48,9 +49,11 @@ type PartialRequest = {
  * @param spanOrigin - The origin of the span
  * @param request - The request object, see {@link PartialRequest}
  * @param routeName - The name of the route, must be low cardinality
+ * @param client - The client the span belongs to, used to resolve `dataCollection.urlQueryParams`.
+ * Falls back to the current scope's client when omitted, which is the wrong one in a multi-client setup.
  * @returns The span name and attributes for the HTTP operation
  */
-export declare function getHttpSpanDetailsFromUrlObject(urlObject: URLObject | undefined, kind: 'server' | 'client', spanOrigin: string, request?: PartialRequest, routeName?: string): [name: string, attributes: SpanAttributes];
+export declare function getHttpSpanDetailsFromUrlObject(urlObject: URLObject | undefined, kind: 'server' | 'client', spanOrigin: string, request?: PartialRequest, routeName?: string, client?: Client): [name: string, attributes: SpanAttributes];
 /**
  * Parses string form of URL into an object
  * // borrowed from https://tools.ietf.org/html/rfc3986#appendix-B

package/node_modules/@sentry/core/build/types-ts3.8/shared-exports.d.ts

@@ -28,6 +28,7 @@ export { _INTERNAL_skipAiProviderWrapping, _INTERNAL_shouldSkipAiProviderWrappin
 export { filterKeyValueData as _INTERNAL_filterKeyValueData } from './utils/data-collection/filterKeyValueData';
 export { filterCookies as _INTERNAL_filterCookies } from './utils/data-collection/filterCookies';
 export { filterQueryParams as _INTERNAL_filterQueryParams } from './utils/data-collection/filterQueryParams';
+export { filterCollectedUrl, filterCollectedUrlQuery } from './utils/data-collection/filterCollectedUrl';
 export { envToBool } from './utils/envToBool';
 export { applyScopeDataToEvent, mergeScopeData, getCombinedScopeData } from './utils/scopeData';
 export { prepareEvent } from './utils/prepareEvent';

package/node_modules/@sentry/core/build/types-ts3.8/utils/data-collection/filterCollectedUrl.d.ts

@@ -0,0 +1,21 @@
+import { Client } from '../../client';
+/**
+ * Applies `dataCollection.urlQueryParams` to a URL the SDK collected itself, for use as `url.full`.
+ *
+ * Call this at every site where instrumentation records a URL. Routing the SDK's own URLs through a
+ * helper is what makes the filtering provenance-correct: a URL a user attaches themselves never passes
+ * through here, and `dataCollection` is only meant to gate automatically collected data.
+ *
+ * Pass the `client` the URL belongs to whenever one is at hand — falling back to `getClient()` resolves
+ * against the current scope, which is the wrong client in a multi-client setup.
+ */
+export declare function filterCollectedUrl(url: string, client?: Client): string;
+export declare function filterCollectedUrl(url: string | undefined, client?: Client): string | undefined;
+/**
+ * Applies `dataCollection.urlQueryParams` to a query string the SDK collected itself, for use as
+ * `url.query`. Returns `undefined` when the query must not be collected at all.
+ *
+ * See {@link filterCollectedUrl} for why this is a helper and why passing `client` is preferred.
+ */
+export declare function filterCollectedUrlQuery(query: string | undefined, client?: Client): string | undefined;
+//# sourceMappingURL=filterCollectedUrl.d.ts.map

package/node_modules/@sentry/core/build/types-ts3.8/utils/data-collection/filterKeyValueData.d.ts

@@ -1,4 +1,5 @@
 import { CollectBehavior } from '../../types/datacollection';
+export declare function shouldFilterDataKey(key: string, behavior: CollectBehavior, additionalDenyTerms?: string[]): boolean;
 /**
  * Filters a key-value record according to a `CollectBehavior`.
  *

package/node_modules/@sentry/core/build/types-ts3.8/utils/data-collection/filterQueryParams.d.ts

@@ -2,8 +2,7 @@ import { CollectBehavior } from '../../types/datacollection';
 /**
  * Filters a query parameter string according to a `CollectBehavior`.
  *
- * When individual params can be parsed, each key-value pair is filtered
- * independently. When parsing fails, the entire string is replaced with `[Filtered]`.
+ * Parameter names are decoded for filtering, while the original encoding, order, and duplicate keys are preserved.
  */
-export declare function filterQueryParams(queryString: string, behavior: CollectBehavior): Record<string, string> | string;
+export declare function filterQueryParams(queryString: string, behavior: CollectBehavior): string | undefined;
 //# sourceMappingURL=filterQueryParams.d.ts.map

package/node_modules/@sentry/core/build/types-ts3.8/utils/data-collection/filterUrlQuery.d.ts

@@ -0,0 +1,13 @@
+import { CollectBehavior } from '../../types/datacollection';
+/**
+ * Applies a `CollectBehavior` to the query string of a full URL, leaving every other URL component
+ * (scheme, host, path, fragment) untouched.
+ *
+ * The query is located by string offsets rather than by parsing, so the URL is returned byte-for-byte
+ * apart from the query itself. This keeps relative URLs, non-HTTP schemes and unusual encodings intact,
+ * none of which survive a `URL` round-trip.
+ *
+ * Returns the URL with its query filtered, or with the query removed entirely when collection is off.
+ */
+export declare function filterUrlQuery(url: string, behavior: CollectBehavior): string;
+//# sourceMappingURL=filterUrlQuery.d.ts.map

package/node_modules/@sentry/core/build/types-ts3.8/utils/url.d.ts

@@ -1,3 +1,4 @@
+import { Client } from '../client';
 import { SpanAttributes } from '../types/span';
 type PartialURL = {
     host?: string;
@@ -48,9 +49,11 @@ type PartialRequest = {
  * @param spanOrigin - The origin of the span
  * @param request - The request object, see {@link PartialRequest}
  * @param routeName - The name of the route, must be low cardinality
+ * @param client - The client the span belongs to, used to resolve `dataCollection.urlQueryParams`.
+ * Falls back to the current scope's client when omitted, which is the wrong one in a multi-client setup.
  * @returns The span name and attributes for the HTTP operation
  */
-export declare function getHttpSpanDetailsFromUrlObject(urlObject: URLObject | undefined, kind: 'server' | 'client', spanOrigin: string, request?: PartialRequest, routeName?: string): [
+export declare function getHttpSpanDetailsFromUrlObject(urlObject: URLObject | undefined, kind: 'server' | 'client', spanOrigin: string, request?: PartialRequest, routeName?: string, client?: Client): [
     /*name*/ string,
     /*attributes*/ SpanAttributes
 ];

package/node_modules/@sentry/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/core",
-  "version": "10.75.1",
+  "version": "10.76.0",
   "description": "Base implementation for all Sentry JavaScript SDKs",
   "repository": "git://github.com/getsentry/sentry-javascript.git",
   "homepage": "https://github.com/getsentry/sentry-javascript/tree/master/packages/core",
@@ -78,7 +78,8 @@
     }
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "tag": "v10"
   },
   "scripts": {
     "build": "run-p build:transpile build:types",

package/node_modules/@sentry/node/build/cjs/integrations/tracing/vercelai/instrumentation.js

@@ -25,6 +25,9 @@ function processToolCallResults(result) {
   if (typeof result !== "object" || result === null || !("content" in result)) {
     return;
   }
+  if (typeof result.consumeStream === "function") {
+    return;
+  }
   const resultObj = result;
   if (!Array.isArray(resultObj.content)) {
     return;

package/node_modules/@sentry/node/build/esm/integrations/tracing/vercelai/instrumentation.js

@@ -23,6 +23,9 @@ function processToolCallResults(result) {
   if (typeof result !== "object" || result === null || !("content" in result)) {
     return;
   }
+  if (typeof result.consumeStream === "function") {
+    return;
+  }
   const resultObj = result;
   if (!Array.isArray(resultObj.content)) {
     return;

package/node_modules/@sentry/node/build/esm/package.json

@@ -1 +1 @@
-{"type":"module","version":"10.75.1","sideEffects":false}
+{"type":"module","version":"10.76.0","sideEffects":false}